CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. The flaw affects systems that manage mobile endpoints and therefore gives an attacker a direct path into an organization's device-management infrastructure.

How it works

CWE-94 describes improper control of code generation, allowing an attacker to supply input that the application later executes as code. In this case the weakness permits unauthenticated remote code execution, so an attacker can submit crafted input over the network and have it run on the server without prior authentication.

Am I affected? How to find it in your systems

Inventory all deployments of Ivanti Endpoint Manager Mobile (EPMM). The product typically runs as a server component that communicates with mobile devices and management consoles. Check both on-premises installations and any cloud-hosted instances. Confirm the exact versions and configurations in use against the vendor advisory, as only the advisory lists the affected releases.

• Review installed software inventories and configuration-management databases for EPMM entries.
• Examine network-exposed services that accept unauthenticated requests to the EPMM endpoints.
• Monitor application and web-server logs for anomalous input patterns that could indicate code-injection attempts; specific indicators must be validated against vendor guidance.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, review and apply any additional hardening steps the vendor provides for this class of code-injection issue.

If you can't patch immediately

Follow the mitigations listed in the vendor instructions. Where EPMM is delivered as a cloud service, apply the controls required by CISA BOD 22-01. If mitigations cannot be implemented, discontinue use of the affected product until a fix is in place. Network segmentation that restricts unauthenticated access to the EPMM server can reduce exposure while remediation is pending.

If your data may have been exposed

Code-injection vulnerabilities that permit remote code execution have been used to obtain persistent access in other environments. Organizations can run a free exposure scan of their email addresses against known breach data to check for prior compromise.